Alfresco - "Commercial Open Source"

So I don't want to sound like too much of a hater, although the purpose of this blog is to give me a place to vent, but I'm very unimpressed with Alfresco's "open source" business model.

While the Church of the Free Software Foundation would have us believe that source code is a basic human right, other companies like Alfresco have a more restrictive view when it comes to the licensing of their code. And really I'm ok with that. Just because something is trivial to duplicate and distribute does not mean that it has no monetary value. Work is work.

What I do have a problem with are various voices from the Alfresco blogs ripping on closed source vendors and patting themselves on the back as if they were on the same level as "real" open source companies like, for instance, the Apache Software Foundation. There's a big difference between commercial open source companies like Alfresco and less restrictive entities like Apache.

Alfresco maintains two open source branches of their software. One for the so-called community, and one for the Starship Enterprise (i.e. paying customers). What's wrong with that?

Well, for starters I've come across bugs in Community version of Alfresco that I know are fixed in Enterprise. Even though the Community or "Labs" version of Alfresco continues to plow along and is nearly at version 3.0, show-stopper bug fixes from Enterprise 2.1+ are still not merged into Community. Ok, it's open source, so I can fix them, right?

Let me ask you this: why should I? If I were to fix the JSR-168 authentication flaw that's holding me back from actually using Alfresco, then I would be duplicating work that has already been done. Not only that, but the severity of the flaw would almost certainly mean that my fix would be of lesser quality than the fix that already exists because I am not an Alfresco developer. Even if I did fix it, and fix it well, there's nobody to give my fix back to because Alfresco doesn't take a lot of community contributions, and (have I mentioned this?), it's already fixed.

So let's talk about the Alfresco Community for a moment. Where is it? I'm seeing an outdated Wiki and some very inactive forums where moderators spend more time moving threads around to "appropriate" forums than answering questions. The use of the word Community here is a bit of a stretch, and has no greater value than I'd expect to get from a closed-source product. The Alfresco Community is less of an "open source community" and more like a gathering of frustrated but oddly grateful beta testers.

In addition to these not-so-opensourcey qualities of Alfresco is the biggest slap in the face of all: the cute little "nag screen" at the bottom of every page rendered by the Community version. You know, the one that reads: "This software might not be any good because the company running it hasn't paid any money." While much of the look and feel of Alfresco can be easily changed, this little gem is actually buried in the Java source. On purpose. To irritate you into paying. Cute.

"Dude, why don't you just shut up and pay for the software?"

I'm not convinced that it's worth paying for yet. If Alfresco has a similar pricing structure to other open source commercial/support companies, then it's probably more expensive than its closed source competitors. Whoa, did I say that? Yeah. Despite what you might have been led to believe, products like Sharepoint from terrible companies like Microsoft are actually dirt cheap for small to medium sized companies. Sure, you don't get free support with the license fees, but at least I'm not forced to pay extra for something I haven't to this day had to use.

So why should I fork over the cash if the "demo" version I'm using doesn't even correctly implement a fairly straight-foward feature? A feature that is actually specified in a formal standard no less!

"Yeah, but it's worth the price because it's open source, which is all open and not all closed 'n' stuff."

I love open source, but in this case I'm not really sure what the benefit is. I don't use open source software because I'm afraid that some day the vendor will go out of business and I'll be able to continue modifying the software myself. I'm certainly not going to just assume that the "community" is going to pick it up and save the day. I do like open source because I can modify the behavior of the software and fix bugs if need be, but this is really something that I rarely want to do. I'm interested in the software because I want to use the software. And I certainly don't want to be fixing bugs in software that I'm paying support fees for.

If an open source application isn't fully open source then its appeal is greatly diminished. The community around it is diminished. It's really only slightly more interesting than closed source alternatives.

"Ok, so you're still saying that Alfresco is more intersting than its closed source competitors. What the hell is your problem?"

Well, frankly I'm just sick and tired of the Alfresco bloggers ripping on closed source companies. Alfresco is not a community driven open source project, and I certainly don't feel that they have any business taking the moral highground and ripping on their closed source competition. Suck it up, Alfresco, and open the the real source. Microsoft might have its head up its ass when it comes to understanding the benefits of open source, but you've only got one eye peeking out.

"Does it make you feel better to make up these insulting questions that I, the reader, am supposedly dying to ask you?"

Why, yes. Yes it does. Thanks.

Liferay + Alfresco = Lalfrescoray

Hey what's that, some egg on my face?

My comments about the Liferay WebDAV support in this whiny article are incorrect. As of Liferay 5.1 WebDAV does seem to work since I replaced a goofy NIC in my server. Please see the article comments for more information.

*************************************

Once again I find myself stuck between two partial solutions that I can't combine to solve what seems to me to be a rather simple problem. Here it is:

1) I need a "portal".
2) I need a document management "portlet".
3) I must access the document management system via CIFS or WebDAV.
4) The system must be somewhat seamless; single sign on at least.

After reviewing some options, I decided that Liferay should be able to meet my requirements. It's a "portal" with lots of "portlets" included, including document management. (notice my sarcastic quotation marks)

DENIED: Liferay's WebDAV doesn't work well enough to be considered well enough.

Ok ok, I've heard a lot of talk on the ol' blogosphere about integrating Alfresco and Liferay. From all the buzz it must be a pretty good solution, especially with all this "web script" stuff on the Alfresco side. Plus Alfresco has some great features that I can take advantage of, and I know that it's CIFS support works because I've used it in the past.

FAIL. Liferay and Alfresco do not mix. Like, not at all. Well, not if you want to use Alfresco 2.1 Community or better. (BTW, the latest Liferay Alfresco Content Portlet 5.0.0.1 uses Alfresco 2.0) Ok ok, I'm being a little too negative. They do mix I'm sure if you write your own authentication filter to make SSO work. No problem!

You see, both Liferay and Alfresco love talking it up about standards support, like JSR-168, but it seems that neither of them pull it off well enough to, you know, INTEROPERATE.

The guy (guys?) at Cignex have a supposed solution using CAS between the two, but Alfresco doesn't jive with CAS as easily as Liferay, and I couldn't get this working reliably for SSO. I even bought this book called "Liferay Portal Enterprise Intranets" by Jonas Yuan in anticipation of the Alfresco integration section. What a complete bust and $60 down the drain. The book isn't necessarily bad, but the devil is in the details and the book is unfortunately devil-free.

Not suprisingly, another solution is to simply purchase Alfresco Enterprise, because it uses a different code base than community. In fact, Alfresco Enterprise 2.2+ will work with Liferay while Alfresco Community 2.9B will not. Open source? Sorta.

Frankly, I'm a little bit suprised to see the world of open source portals and document mangagement systems still in such a ridiculous state. Liferay has more bugs than a volkswagon dealer and both Liferay and Alfresco are stupidly difficult to configure in any interesting way, as all Java-based web applications seem to be. XML NIGHTMARE! Here's a tip: if it takes weeks just to understand how to configure your software, then your software isn't finished. Excessive meta configuration files are not a feature. Most of your users don't give a shit about Java Beans or any other beans for that matter.

Community? Not very good in either camp. Outdated documents, wikis (DIE WIKI DIE) and very poor forum support.

Not to just pick on Liferay and Alfresco, I've also tried out Exo and Icecore (built on Liferay) with limited success. I've looked at the JBoss portal a few times also but I just can't get over them basing their forum portlet on phpBB. I know, sounds petty, but phpBB....jesus...I don't want to think about this anymore. Bye.

Oh, and one more thing (damn I'm frustrated). HTTP Basic Auth is NOT a good solution for any feature of any software intended to be used in the Enterprise. (yes, including the Starship Enterprise) Pushing it over SSL only makes transport safer, and doesn't solve the root problem. (and we're just self-signing anyhow, even if we don't like to admit to it) And entering a password into a browser is NOT a good solution, ever. Receiving a password from a web browser is NOT a good solution. This is all the more true on the Starship Enterprise where people are either using potentially weak SSO or making all of their passwords match. The last thing you want are domain passwords in your damn browser cookies. I'm looking at you, REST authentication appologist!